replace the exec spawning implementation; add compat zygote instance which uses scudo instead of hardened_malloc by muhomorr · Pull Request #364 · GrapheneOS/platform_frameworks_base

muhomorr · 2026-06-12T17:20:05Z

New app processes are created by forking zygote, then immediately exec()-ing a new zygote and
replaying commands that were sent to the original zygote in the new zygote. Commands are passed to
the new zygote through a memfd.

Exec spawning can be disabled on a per-app basis.

App processes that are spawned through secondary zygotes (WebView processes and service processes
which use an app zygote) are instead spawned through the primary zygote. Boot-time WebView zygote
startup is disabled to reduce memory usage. The WebView zygote is started on-demand to support apps
that are opted out of exec spawning.

Part of a changelist:
GrapheneOS/platform_art#37
GrapheneOS/platform_packages_apps_AppCompatConfig#15
GrapheneOS/platform_packages_apps_Settings#432
GrapheneOS/platform_packages_modules_ConfigInfrastructure#8
GrapheneOS/platform_system_core#40
GrapheneOS/platform_system_sepolicy#82

GrapheneOS-Archive/platform_cts#3
GrapheneOS/platform_manifest#96
GrapheneOS/script#112

Includes #358
Obsoletes #359

Closes: GrapheneOS/os-issue-tracker#413
Closes: GrapheneOS/os-issue-tracker#611
Closes: GrapheneOS/os-issue-tracker#2170
Closes: GrapheneOS/os-issue-tracker#2531
Closes: GrapheneOS/os-issue-tracker#2886
Closes: GrapheneOS/os-issue-tracker#6349
Closes: GrapheneOS/os-issue-tracker#7877
Closes: GrapheneOS/os-issue-tracker#7899

This reverts commit 97f2e33.

…d GC" This reverts commit 4a2b6c9.

… VA space" This reverts commit 3e721e6.

… crashes" This reverts commit 4d61cd0.

This reverts commit 6716125

…ess init Run the onBind() hook at an earlier point by removing its dependency on the app context object. This is required by the next commit.

Use AppBindArgs to pass systemIdmapPaths to the app instead of performing an extra Binder IPC call to ActivityManagerService during app process launch.

For background, see https://grapheneos.org/usage#exec-spawning New app processes are created by forking zygote, then immediately exec()-ing a new zygote and replaying commands that were sent to the original zygote in the new zygote. Commands are passed to the new zygote through a memfd. Exec spawning can be disabled on a per-app basis. App processes that are spawned through secondary zygotes (WebView processes and service processes which use an app zygote) are instead spawned through the primary zygote. Boot-time WebView zygote startup is disabled to reduce memory usage. The WebView zygote is started on-demand to support apps that are opted out of exec spawning. Test: atest GosCompatSecureSpawnTests

This zygote instance is used when both exec spawning and hardened_malloc are disabled.

…s.Global ConnChecksSetting.get() is used by Vanadium. Accessing it worked without the UnsupportedAppUsage annotation due to broken hidden API access enforcement with the previous exec spawning implementation.

Remove leftover useFifoUi change.

inthewaves · 2026-06-13T01:22:37Z

+            if (type == ZygoteType.Compat) {
+                // compat zygote is started on-demand, it might not be running when bootCompleted()
+                // is dispatched to other zygotes
+                bootCompleted(Build.SUPPORTED_64_BIT_ABIS[0], ZygoteSelectionMode.PreferCompatZygote);
+            }


Could this be called before bootCompleted() is dispatched?

No, since the core system processes don't use the compat zygote. The bootCompleted() callback is used by ART JIT compiler for deferred boot-profile-related tasks which aren't relevant on GrapheneOS.

inthewaves · 2026-06-13T01:36:41Z

+                    if (!r.definingPackageName.equals(r.appInfo.packageName)) {
+                        new SystemErrorNotification("exec spawning error", "mismatch between definingPackageName (" + r.definingPackageName + ") and appInfo package name (" + r.appInfo.packageName + ") for service " + r.name).show(mAm.mContext);
+                    }
+                    if (!AswUseExecSpawning.I.get(mAm.mContext, r.userId, r.appInfo, GosPackageState.get(r.definingPackageName, r.userId))) {
+                        // app zygotes are pointless when exec spawning is used
+                        hostingRecord = HostingRecord.byAppZygote_(r.instanceName, r.definingPackageName,
+                                r.definingUid, r.serviceInfo.processName);
+                    }


With secure app spawning enabled by default, atest CtsExternalServiceTestCases:android.externalservice.cts.ExternalServiceTest has test failures:

[5/13] android.externalservice.cts.ExternalServiceTest#testBindExternalServiceWithZygote: FAILED (529ms) STACKTRACE: junit.framework.AssertionFailedError: Expected <-1> should not be equal to actual <-1> at junit.framework.Assert.fail(Assert.java:50) at junit.framework.Assert.assertTrue(Assert.java:20) at junit.framework.Assert.assertFalse(Assert.java:34) at android.externalservice.cts.ExternalServiceTest.assertNotEquals(ExternalServiceTest.java:481) at android.externalservice.cts.ExternalServiceTest.testBindExternalServiceWithZygote(ExternalServiceTest.java:315) [6/13] android.externalservice.cts.ExternalServiceTest#testBindExternalServiceWithZygoteWithRunningOwn: FAILED (1.105s) STACKTRACE: junit.framework.AssertionFailedError: Expected <-1> should not be equal to actual <-1> at junit.framework.Assert.fail(Assert.java:50) at junit.framework.Assert.assertTrue(Assert.java:20) at junit.framework.Assert.assertFalse(Assert.java:34) at android.externalservice.cts.ExternalServiceTest.assertNotEquals(ExternalServiceTest.java:481) at android.externalservice.cts.ExternalServiceTest.testBindExternalServiceWithZygoteWithRunningOwn(ExternalServiceTest.java:380)

When secure app spawning is disabled, those 13 tests pass but still has these error notifications:

E SystemErrorNotification: exec spawning error, title: exec spawning error, message: mismatch between definingPackageName (android.externalservice.service) and appInfo package name (android.externalservice.cts) for service ComponentInfo{android.externalservice.cts/android.externalservice.service.ExternalServiceWithZygote}

https://github.com/GrapheneOS/platform_frameworks_base/blob/2026060600/services/core/java/com/android/server/am/ProcessList.java#L2098-L2101 might explain this mismatch

How should we handle apps that specify a ZygotePreload (android:zygotePreloadName) class with android:useAppZygote="true" services in application manifest, e.g.

https://cs.android.com/android/platform/superproject/+/android-latest-release:cts/tests/tests/externalservice/service/AndroidManifest.xml

<application android:label="External Service Host" android:zygotePreloadName="android.externalservice.service.ZygotePreload"> ... <service android:name=".ExternalServiceWithZygote" android:isolatedProcess="true" android:externalService="true" android:exported="true" android:useAppZygote="true" android:allowSharedIsolatedProcess="true"/>

Some other CTS tests also rely on android:zygotePreloadName such as CtsSeccompHostTestCases and CtsAppServiceTestCases, so those tests are currently failing with secure app spawning on as well

App zygote preloading wasn't done in exec-spawned children of app zygotes in the previous implementation. The purpose of preloading is to create memory regions that are shared among zygote children, which is fundamentally incompatible with exec spawning. AFAIK Chromium-based browsers are the only users of the app zygote functionality. I'm not aware of any reports of app compatibility issues that are caused by ZygotePreload being ignored.

See 837ec57 and aa8c224

Also updated CTS tests: GrapheneOS-Archive/platform_cts#3

inthewaves · 2026-06-13T03:13:53Z

+    private void startCompatZygote() throws IOException {
+        SystemProperties.set("sys.start_compat_zygote", "1");
+        boolean started = false;
+        LocalSocketAddress zygoteSocketAddress = mZygoteSocketAddresses[ZygoteType.Compat.ordinal()];
+
+        try (var zygoteSocket = new LocalSocket()) {
+            for (int i = 0; i < 2000; ++i) {
+                try {
+                    zygoteSocket.connect(zygoteSocketAddress);
+                    started = true;
+                    break;
+                } catch (IOException e) {
+                    if ((i % 20) == 0) {
+                        Log.d(LOG_TAG, "waiting for compat zygote to start");
+                    }
+                    SystemClock.sleep(10);
+                }
+            }
+        }
+        if (!started) {
+            throw new RuntimeException("timed out while waiting for compat zygote");
+        }
+    }


startCompatZygote can do a blocking wait of up to 20s while holding mLock, as this is called from attemptConnectionToZygote which is guarded by mLock. The lock might not be needed (mZygoteSocketAddresses looks like it's already initialized in constructor with immutable LocalSocketAddresses) and could be avoided by just reacquiring lock after and checking if mZygoteStates was already initialized after the call

App process launches are guarded by the global ActivityManagerService lock.

Can avoid this and other lazy-init-related issues by starting the compat zygote at boot, but it uses ~200 MiB of RAM.

The upstream ZygoteProcess.waitForConnectionToZygote() method has a timeout of 60 seconds and holds the same locks.

Added more comments: f5ac3d7

inthewaves · 2026-06-13T03:39:04Z

atest CtsHiddenApiBlocklistCurrentApiTestCases CtsHiddenApiBlocklistTestApiTestCases passing with Settings > Security & privacy > Exploit protection > Secure app spawning set to both on and then retested with it off

Tesco app (com.tesco.grocery.view) no longer crashes a few seconds after launch with secure spawning disabled (it does still run into memory issues that hardened_malloc detects, so users should probably still turn on the broad exploit compatibility mode anyway)

…zygotes

…d_malloc

Simplify and speed up handling of parent file descriptors in the child process by using the close_range(CLOSE_RANGE_CLOEXEC) + exec() pattern. This change also fixes a potential issue of a Java daemon thread opening a file descriptor between GetOpenFdsIgnoring() and fork() which would have caused file descriptor table check to fail in the child process.

…d_malloc

strerror() is not guaranteed to be async-safe. Use "%#m" instead, which outputs the name (not description) of errno value, e.g. EPERM.

Add handling of app zygote preloading.

Add missing handling for external services which are spawned from an app zygote.

inthewaves · 2026-06-13T12:14:52Z

+        }
+    }
+
+    pid_t pid = fork();


Remark: bionic fork() does extra function calls and hooks: https://github.com/GrapheneOS/platform_bionic/blob/16-qpr2/libc/bionic/fork.cpp, https://github.com/GrapheneOS/platform_bionic/blob/16-qpr2/libc/bionic/pthread_atfork.cpp#L139, https://github.com/GrapheneOS/platform_bionic/blob/16-qpr2/libc/include/unistd.h#L93-L98

This might be unnecessary if child intended to only mark fds CLOEXEC and immediately exec (vs the normal zygote spawning path staying in the process). Child looks async-signal-safe anyway for _Fork

inthewaves · 2026-06-13T12:23:33Z

+    if (disable_hardened_malloc) {
+        if (setenv("DISABLE_HARDENED_MALLOC", "1", 1) != 0) {
+            ALOGE("setenv failed: %s", strerror(errno));
+            close(cmd_fd);
+            return -1;
+        }
+    }


Parent process is multithreaded but this is technically modifying shared global state for parent process. bionic setenv doesn't seem thread-safe. Probably could snapshot an envp, though execv() fallback in child is also just using global environ so that'd also need updating

Replace non-thread-safe usages of setenv() and unsetenv().

Ensure that no new file descriptors are racily opened by signal handlers in the child process.

muhomorr and others added 19 commits June 12, 2026 17:13

fixup! support for per-app dynamic code loading restrictions

188eb8f

Revert "match the initial call stack between exec and zygote spawning"

af53bfd

This reverts commit 97f2e33.

Revert "exec spawning: add workaround for late init of ART userfaultf…

6211b12

…d GC" This reverts commit 4a2b6c9.

Revert "exec spawning: support disabling hardened_malloc and extended…

8ac7055

… VA space" This reverts commit 3e721e6.

Revert "exec spawning: don't close the binder connection when the app…

78965f1

… crashes" This reverts commit 4d61cd0.

Revert "add a wrapper for execveat(2)"

480df60

This reverts commit 6716125

remove the previous exec spawning implementation

0c93020

fixup! AppBindArgs: infrastructure for passing extra args to app proc…

cf94099

…ess init Run the onBind() hook at an earlier point by removing its dependency on the app context object. This is required by the next commit.

fixup! exec spawning: support runtime resource overlays

9b6c191

Use AppBindArgs to pass systemIdmapPaths to the app instead of performing an extra Binder IPC call to ActivityManagerService during app process launch.

gosps: add USE_EXEC_SPAWNING flags

c8d4d09

refactor zygote infrastructure to support arbitrary number of zygotes

6c6f222

add compat zygote instance which uses scudo instead of hardened_malloc

2d1e1b6

This zygote instance is used when both exec spawning and hardened_malloc are disabled.

add GosCompatSecureSpawnTests

14d1513

adjust GosCompatSecureSpawnTests to exec spawning changes

26163a3

fixup! add base class for complex per-app switches

346244e

fixup! add per-app setting for hardened_malloc and extended VA space

82c56ce

fixup! add connectivity checks setting and its migration from Setting…

6321859

…s.Global ConnChecksSetting.get() is used by Vanadium. Accessing it worked without the UnsupportedAppUsage annotation due to broken hidden API access enforcement with the previous exec spawning implementation.

fixup! add exec spawning implementation

e30221d

Remove leftover useFifoUi change.

inthewaves suggested changes Jun 13, 2026

View reviewed changes

This was referenced Jun 13, 2026

apply hidden API policy after exec spawning + pass disabled compat changes through exec spawning #359

Closed

add GosCompatSecureSpawnTests #358

Closed

muhomorr added 6 commits June 13, 2026 05:11

fixup! gosps: add USE_EXEC_SPAWNING flags

92b6c5a

fixup! refactor zygote infrastructure to support arbitrary number of …

8a9dd14

…zygotes

fixup! add compat zygote instance which uses scudo instead of hardene…

43dbbca

…d_malloc

fixup! add exec spawning implementation

6c983a6

fixup! add compat zygote instance which uses scudo instead of hardene…

7e91067

…d_malloc

muhomorr added 5 commits June 13, 2026 07:33

fixup! add compat zygote instance which uses scudo instead of hardene…

f5ac3d7

…d_malloc

fixup! add exec spawning implementation

e0acbf0

strerror() is not guaranteed to be async-safe. Use "%#m" instead, which outputs the name (not description) of errno value, e.g. EPERM.

fixup! add exec spawning implementation

837ec57

Add handling of app zygote preloading.

fixup! add exec spawning implementation

aa8c224

Add missing handling for external services which are spawned from an app zygote.

fixup! add exec spawning implementation

2d9b0db

inthewaves suggested changes Jun 13, 2026

View reviewed changes

muhomorr added 4 commits June 13, 2026 12:58

fixup! add exec spawning implementation

22141b7

fixup! add exec spawning implementation

3a5a33d

fixup! add exec spawning implementation

ea6744b

Replace non-thread-safe usages of setenv() and unsetenv().

fixup! add exec spawning implementation

486c24c

muhomorr force-pushed the 16-qpr2_06-12_base branch 2 times, most recently from 2926e43 to 43a668e Compare June 13, 2026 15:14

fixup! add exec spawning implementation

3063d1a

Ensure that no new file descriptors are racily opened by signal handlers in the child process.

muhomorr force-pushed the 16-qpr2_06-12_base branch from 43a668e to 3063d1a Compare June 13, 2026 15:26

Conversation

muhomorr commented Jun 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

inthewaves Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

inthewaves Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

inthewaves commented Jun 13, 2026

Uh oh!

Uh oh!

inthewaves Jun 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

muhomorr commented Jun 12, 2026 •

edited

Loading

inthewaves Jun 13, 2026 •

edited

Loading

inthewaves Jun 13, 2026 •

edited

Loading

inthewaves Jun 13, 2026 •

edited

Loading